HUSKY
HUSKY Products Filter for WooCommerce 1.4.4 and earlier permits unauthenticated local PHP file inclusion through its AJAX product rendering path. Update to 1.4.5 or later.
HUSKY – Products Filter for WooCommerce Professional 1.4.4 and earlier is affected by an unauthenticated local file inclusion flaw, CVE-2026-92969. The plugin has more than 80,000 active installations. Update to 1.4.5 or later now.
Wordfence scores this issue 8.1 (High). Patchstack assigns a 10.0 score and describes it as remote file inclusion, while Wordfence’s underlying technical record specifically describes inclusion of PHP files already readable on the server. Site owners should use the more precise local-file-inclusion model when assessing exposure.
Affected systems and exploit path
- Plugin: HUSKY – Products Filter for WooCommerce Professional (
woocommerce-products-filter) - Affected versions: 1.4.4 and earlier
- Privilege required: None
- Attack class: Local PHP file inclusion through product-rendering AJAX and a shortcode-derived template path
- Fixed version: 1.4.5
Wordfence’s disclosure describes a path through the woof_draw_products AJAX action and the custom_tpl shortcode attribute. A front-end nonce is publicly emitted to visitors, so it does not establish authentication. An unauthenticated request can make the server include a chosen local PHP file. This may expose sensitive data or execute code already present in that file; the most serious outcome depends on which readable PHP files exist on the installation.
Patch and containment
- Update the plugin to 1.4.5 or later from the official WordPress plugin directory.
- Back up first, then verify WooCommerce catalog filtering, product archives, and custom filter templates.
- If you cannot patch promptly, deactivate HUSKY until you can. A public WordPress nonce, cache rule, or generic WAF is not a substitute for this fix.
- Inventory custom product templates and writable directories containing PHP files.
wp plugin get woocommerce-products-filter --fields=name,status,version,update --format=tableDetection and remediation
Review web-server and WAF logs for unusual requests to admin-ajax.php involving woof_draw_products, particularly around and after September 21, 2026. Look for unexpected PHP files in writable directories, newly created administrator accounts, modified plugins or themes, and unfamiliar scheduled tasks. Preserve suspicious files and logs before cleanup. These checks identify leads; they do not prove that a site was exploited.
Sources
